Freedom251 › Digital Forensics Software
Tsurugi Linux
What Tsurugi Linux is
Tsurugi Linux is a free Linux distribution for digital forensics, incident response, malware analysis, and OSINT. Its 64-bit LAB edition is based on Ubuntu 24.04.3 LTS and uses a custom kernel based on version 6.19.10. Kernel-level device write blocking is included, alongside a Computer Vision analysis section and an OSINT profile switcher. The system can run in live mode, though its main aim is installation as a forensics lab. Tsurugi Acquire is a separate lightweight 32-bit live edition for booting a PC and acquiring mass storage devices. The related Bento toolkit is portable and includes over 300 applications for live forensics and incident response on Windows, Linux, and macOS. LAB updates come from official Ubuntu repositories, but the FAQ warns that a dist-upgrade can break the OS. The project recommends checking download hashes and using its PGP public key to verify signatures. The LAB and Acquire editions are free under the GNU General Public License and come without warranty; some included tools are not open source.
Who it suits
Tsurugi Linux is aimed at people doing digital forensics, incident response, malware analysis, or OSINT. The project also describes educational use and assistance to law enforcement and professionals as goals.
What it does well
- Includes kernel-level device write blocking.
- Can run in live mode.
- Acquire edition boots PCs to acquire storage.
- Bento includes over 300 applications.
What to know first
- Provided without warranty.
- Some included tools are not open source.
- A dist-upgrade can break the OS.
Limits
Tsurugi Linux [LAB] and Tsurugi Acquire are provided without warranty, and some included tools are not open source. The project FAQ cautions that a dist-upgrade can break the OS.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Tsurugi Linux [LAB] | 64-bit Linux distribution · provided as-is without warranty | Free |
As tsurugi-linux.org lists them, read 3 Oct 2026. The maker's own page has the final word.
Getting started
- Visit https://tsurugi-linux.org/
- Choose Tsurugi Linux [LAB] or Tsurugi Acquire for the intended task
- Download the relevant Linux edition
- Check the download hashes and use the project's PGP public key to verify signatures
- Install [LAB] as a forensics lab or run it in live mode
Verdict
Tsurugi Linux combines a forensics-focused installed environment with separate live and portable tools. Review its warranty and update cautions, and verify downloaded files as the project recommends.
Questions
How much does Tsurugi Linux cost?
Tsurugi Linux [LAB] is listed as free. The project says [LAB] and Tsurugi Acquire are free under the GNU General Public License.
Is there a free plan or trial?
The [LAB] edition is free. No free trial is listed.
Which platforms does it support?
The supported platforms listed are 64-bit Linux, Ubuntu 24.04.3 LTS, VirtualBox, and VMware.
Is Tsurugi Linux open source?
The project says [LAB] and Tsurugi Acquire are free under the GNU General Public License. Some included tools are not open source.
Who makes Tsurugi Linux?
The project describes itself as independent, with no commercial brand or company behind it, and says the team develops it in its free time.
What does Tsurugi Acquire do?
It is a lightweight 32-bit live Linux edition for booting a PC and acquiring mass storage devices.
Facts from Tsurugi Linux's own pages
- Acquisition edition
- Tsurugi Acquire is a lightweight 32-bit live Linux edition for booting a PC and acquiring mass storage devices. · tsurugi-linux.org, 3 Oct 2026
- Audience
- The project describes its goal as educational use and helping law enforcement and professionals with daily tasks. · tsurugi-linux.org, 3 Oct 2026
- Base system
- The 64-bit distribution is based on Ubuntu 24.04.3 LTS and has a custom kernel based on version 6.19.10. · tsurugi-linux.org, 3 Oct 2026
- Deployment
- It can run in live mode, though its main goal is to be installed as a default forensics lab. · tsurugi-linux.org, 3 Oct 2026
- Founded
- 2018 · tsurugi-linux.org, 28 Sept 2026
- Licensing and warranty
- The project says Tsurugi Linux [LAB] and Tsurugi Acquire are free under the GNU General Public License and provided without warranty; some included tools are not open source. · tsurugi-linux.org, 3 Oct 2026
- Organization
- The project says it is independent, has no commercial brand or company behind it, and is developed in the team's free time. · tsurugi-linux.org, 3 Oct 2026
- Other features
- It includes a Computer Vision analysis section and an OSINT profile switcher. · tsurugi-linux.org, 3 Oct 2026
- Purpose
- Tsurugi Linux is a customized distribution for digital forensics, incident response, malware analysis, and OSINT. · tsurugi-linux.org, 3 Oct 2026
- Related toolkit
- Bento is a portable toolkit with over 300 applications for live forensics and incident response on Windows, Linux, and macOS. · tsurugi-linux.org, 3 Oct 2026
- Security verification
- The downloads page recommends checking hashes and downloading the project's PGP public key to verify signatures. · tsurugi-linux.org, 3 Oct 2026
- Support
- The FAQ says project questions are usually answered by email within 24 to 48 hours, while basic questions unrelated to the project are no longer answered. · tsurugi-linux.org, 3 Oct 2026
- Updates
- Tsurugi Linux [LAB] retrieves updates from official Ubuntu repositories; the FAQ warns that dist-upgrade can break the OS. · tsurugi-linux.org, 3 Oct 2026
- Write blocking
- It includes device write blocking at the kernel level. · tsurugi-linux.org, 3 Oct 2026
Where Tsurugi Linux stands on Freedom251
- Digital Forensics Software#18 of 30